Windows Assembly Microsoft Visual Studio '.dll' files detected as Malware?

[User1051]

Hi all, first time posting - long time loving malwarebytes <3 
Usually if this program tells me something needs removing.. It's gone. 

However this was a strange detection result for me & from a search of the forum came across this thread:
https://forums.malwarebytes.com/topic/274528-possible-false-positives/

Similar files detected in my instance so not sure if this was a 'false Positive' for malware or a legitimate concern. 

Report Text: 

-Log Details-
Scan Date: 5/22/21
Scan Time: 10:00 PM
Log File: 

-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1292
Update Package Version: 1.0.40772
License: Free

-System Information-
OS: Windows 10 (Build 19042.985)
CPU: x64
File System: NTFS
User: 

-Scan Summary-
Scan Type: Custom Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 525059
Threats Detected: 4
Threats Quarantined: 4
Time Elapsed: 5 hr, 53 min, 41 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 4
Malware.Heuristic.1003, C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALSTU#\1CC944DD5C124CDEDD729318D7E58A87\MICROSOFT.VISUALSTUDIO.TOOLS.OFFICE.EXCEL.HOSTADAPTER.V10.0.NI.DLL, Quarantined, 1000001, 0, 1.0.40772, 0000000000000000000003EB, dds, 01256421, 05700506B9AED6903EF06BF16712DCAC, 4D1A9FCDFB49C46E4FEB7B4C286EFE993C4FF9A5A93B1D19B598B2AE60783248
Malware.Heuristic.1003, C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALSTU#\19AFF3F3EBF30CB55238075BC32615B4\MICROSOFT.VISUALSTUDIO.TOOLS.OFFICE.HOSTADAPTER.V10.0.NI.DLL, Quarantined, 1000001, 0, 1.0.40772, 0000000000000000000003EB, dds, 01256421, 66004EEDB15CB8B52220358EC422CCE9, 8CFD27F585CD7465DAD5A8EA1F117CC18F03462C765F1249AB0ADC5B7B63B487
Malware.Heuristic.1003, C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALSTU#\AADA3E538F5D203301A81D61E90ED116\MICROSOFT.VISUALSTUDIO.TOOLS.OFFICE.WORD.HOSTADAPTER.V10.0.NI.DLL, Quarantined, 1000001, 0, 1.0.40772, 0000000000000000000003EB, dds, 01256421, 190276E91E22A945A900BE5B16A92500, 5C8F088BA43DE04294333346A702FE7ACEF8D377EB84D5398094EF71CFA82215
Malware.Heuristic.1003, C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALSTU#\220FAF66FC4759A55A1BDC74914E1AC6\MICROSOFT.VISUALSTUDIO.TOOLS.OFFICE.OUTLOOK.HOSTADAPTER.V10.0.NI.DLL, Quarantined, 1000001, 0, 1.0.40772, 0000000000000000000003EB, dds, 01256421, 0894D466FF653481439470D2FAD707AE, C359F7E88CA7CD5F448C13430715492105BE98D74EC1334088AD919877FDE7CB

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

[Porthos]

6 minutes ago, User1051 said:

Malware.Heuristic.1003

Hi,

Do you have "Use expert system algorithms to identify malicious files" enabled? It is located in Settings > Security> Scan option.

This is normally disabled by default.

In either way, Staff will look into this and get this fixed.

Thanks for reporting!

FYI

That setting is to detect malformed files but sometimes legit files use protection that make them malformed. Malwarebytes is still tweaking the algorithms that is why it’s off by default. If you switch it on it is assumed you are able to tell the difference between a FP and a legit detection. 

And if you keep it on I suggest also turn off auto quarantine. Gives you the time to report FP's and not go thru the extra step to have to restore from quarantine.

[User1051]

Hi Porthos & Thanks for your reply!

Yes I do have it enabled, I did see this suggested from the other forum page I linked to above. 
Happy to have it enabled and don't mind the extra step, but that is useful information and thanks for explaining. 

More specifically I am interested in finding out if the files are malware, or as you said if they are legit/safe files

Regards, 

[AdvancedSetup]

Please disable the Expert systems setting. Then rescan your system.

[shadowwar]

These files have been whitelisted. 

 

[IArminiusI]

Hi!

I have a similar detection (see below)

So just to be 100% sure. This means i can restore them back from quarantine right? 

Thanks in advance! 

-Log Details-
Scan Date: 5/24/21
Scan Time: 9:41 AM
Log File:  

-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1292
Update Package Version: 1.0.40848
License: Premium

-System Information-
OS: Windows 10 (Build 19042.985)
CPU: x64
File System: NTFS
User:  

-Scan Summary-
Scan Type: Custom Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 677740
Threats Detected: 4
Threats Quarantined: 4
Time Elapsed: 1 hr, 38 min, 43 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 4
Malware.Heuristic.1003, C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALSTU#\4F0131AD4B441A105446C9DDB544B8FC\MICROSOFT.VISUALSTUDIO.TOOLS.OFFICE.OUTLOOK.HOSTADAPTER.V10.0.NI.DLL, Delete-on-Reboot, 1000001, 0, 1.0.40848, 0000000000000000000003EB, dds, 01258883, 0D253FC57CCC8BA974945ABC4D9F2F31, 7F49B1B7182ACF79A3563D9246A524CBCACD80988B95D8D901FABF3FE9449BE6
Malware.Heuristic.1003, C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALSTU#\687E8136D123ECA3691EB2582CEEDEA0\MICROSOFT.VISUALSTUDIO.TOOLS.OFFICE.WORD.HOSTADAPTER.V10.0.NI.DLL, Delete-on-Reboot, 1000001, 0, 1.0.40848, 0000000000000000000003EB, dds, 01258883, DDE6FE015F4945DADB34CDED9491C615, 6343192CA9A9694AB32EE7F4E44E6C1532319F0842277BE9D241D9F82804E647
Malware.Heuristic.1003, C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALSTU#\588585336D397F4D0DC2F2E6A4154F86\MICROSOFT.VISUALSTUDIO.TOOLS.OFFICE.HOSTADAPTER.V10.0.NI.DLL, Delete-on-Reboot, 1000001, 0, 1.0.40848, 0000000000000000000003EB, dds, 01258883, 35543C9074CDBB641F7D312AA33227B2, 86DF8F4A04FCB58D26430FA1E22B69AFC14126ACC6FF2EF9DF51237DD2401EE6
Malware.Heuristic.1003, C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MICROSOFT.VISUALSTU#\7B85F2C927BAEC3EC8E439B6B3D1FB52\MICROSOFT.VISUALSTUDIO.TOOLS.OFFICE.EXCEL.HOSTADAPTER.V10.0.NI.DLL, Delete-on-Reboot, 1000001, 0, 1.0.40848, 0000000000000000000003EB, dds, 01258883, 3CF9B9DFC7C992339F1D8778AFB2F5E7, 98E1E8D623071E5CF3C7E65FD4E746B38D72186F4425331ADD0F6D30BC095409

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

[Porthos]

Just now, IArminiusI said:

So just to be 100% sure. This means i can restore them back from quarantine right? 

Yes and also turn off "Use expert system algorithms to identify malicious files"

It is located in Settings > Security> Scan option.

This is normally disabled by default.

[shadowwar]

these files have been whitelisted. 

 

[User1051]

On 5/24/2021 at 7:20 PM, shadowwar said:

These files have been whitelisted. 

 

Thanks for your reply, have a great day!

[User1051]

On 5/24/2021 at 4:10 PM, AdvancedSetup said:

Please disable the Expert systems setting. Then rescan your system.

Great, thanks for your reply, Is there some information clarifying the use of "expert system algorithms" 
Like a guide, when to use or not use this feature?  

[Porthos]

5 minutes ago, User1051 said:

Great, thanks for your reply, Is there some information clarifying the use of "expert system algorithms" 
Like a guide, when to use or not use this feature?  

FYI. This setting is in the experimental stage. I suggest you keep it off unless you are comfortable dealing with the FP's

That setting is to detect malformed files but sometimes legit files use protection that make them malformed. Malwarebytes is still tweaking the algorithms that is why it’s off by default. If you switch it on it is assumed, you are able to tell the difference between a FP and a legit detection. 

And if you keep it on, I suggest also turn off auto quarantine. Gives you the time to report FP's and not go thru the extra step to have to restore from quarantine.

Edited May 26, 2021 by Porthos